Plans and issuers will need to submit “gag clause” attestations by Dec. 31, 2023 

Regulators recently provided detailed FAQ guidance for group health plan sponsors and health insurance issuers who will attest for the first time that their plan agreements comply with the ban on “gag clauses” under the Consolidated Appropriations Act, 2021 (CAA) by December 31, 2023. We anticipate most plan sponsors will rely on their third party administrator (TPA) or insurance issuer to submit the annual Gag Clause Prohibition Compliance Attestation (attestation) on their behalf.

Even though the first attestation must be made by the end of 2023, group health plans and health insurance issuers have been prohibited since December 27, 2020 from entering into an agreement with a health care provider, network or association of providers, TPA, or other service provider offering access to a network of providers that would directly or indirectly restrict the plan or issuer from:

• Furnishing provider-specific cost or quality of care information or data (e.g., via a consumer engagement tool) to referring providers, the plan sponsor, or covered members (or those eligible to become a covered member);
• Electronically accessing covered members’ de-identified claims and encounter information or data; or
• Sharing such information or data described above with a HIPAA-covered business associate, consistent with applicable federal privacy regulations.

However, a health care provider, network or association of providers, or other service provider may place reasonable restrictions on the public disclosure of this information or data.

Applicability. The current prohibition on gag clauses as well as the attestation requirement applies broadly to fully-insured and self-funded group health plans (including grandfathered plans, church plans and non-Federal governmental plans), individual health insurance coverage, and student health insurance coverage. Neither the prohibition on gag clauses nor the attestation requirement apply to excepted benefits (e.g., accident plans, limited-scope dental or vision plans, on-site medical clinics, specified disease or illness coverage, hospital indemnity coverage) or health reimbursement arrangements (HRAs) or other account-based plans (such as health FSAs). It appears that retiree-only plans are not subject to the prohibition on gag clauses and thus won’t need to make the attestation. 

Submission process. The annual attestation must be submitted through the CMS HIOS portal. Regulators have issued instructions, a system user manual and an Excel reporting template that can be used by plans and issuers for this purpose. The first attestation will cover the period beginning December 27, 2020 and ending on the date of the attestation. Subsequent annual attestations are due by December 31 of each year. 

Fully-insured plan sponsors are deemed to have satisfied the attestation submission requirement when their health insurance issuer submits the attestation on behalf of the fully-insured plan. On the other hand, self-funded plan sponsors can contractually obligate the plan’s third party administrator (TPA) to submit the attestation on the plan’s behalf, but the plan will remain legally liabile

To prepare for the December 31, 2023 attestation deadline, plan sponsors should ensure (if they haven’t already done so) that their plan-related agreements don’t have prohibited gag clauses and engage with service providers to determine who will submit the attestation for them. Plan sponsors may need to update agreements with their vendors to take the attestation requirement into account.